Splunk Search
Highlighted

Is it possible to use fillnull for fieldnames with a specific pattern?

Motivator

Hi,

is it possible to use fillnull for fields with a specific pattern? Wildcards are not working, but I want to avoid using fillnull for each and every field.

For example I would like to fillnull all fieldnames that contain "ABC".

Cheers
Heinz

0 Karma
Highlighted

Re: Is it possible to use fillnull for fieldnames with a specific pattern?

SplunkTrust
SplunkTrust

Try this workaround

...| foreach *ABC* [eval "<<FIELD>>"=coalesce('<<FIELD>>',"YourDefaultValueHere") ]

View solution in original post

Highlighted

Re: Is it possible to use fillnull for fieldnames with a specific pattern?

Motivator

works fine, thanks a lot

0 Karma